Upgrade to release 1.26.5:
- Fixed: Using a relative --path would not find a
.git_archival.json file in a parent directory.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 7.17.2:
- Fix: two different scenarios failed with "attempt to write a
readonly database". These were regressions in 7.17.1. They are
fixed:
- When using a version of SQLite older than 3.34.0, such as on
RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which
combines automatically) always failed.
- coverage combine and coverage debug data failed when a data
file existed but had no coverage schema, for example an empty
file left behind by a worker that died. A file we can’t read is
now reported like any other unusable data file, and is left in
place.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 8.0.0:
- Drop Python 3.10 support (breaking change).
- Drop support for deprecated @cachedmethod features (breaking
change).
- Drop support for @cached(cache=None) (breaking change).
- Require custom cache classes to support __len__ when used with
info=True (breaking change).
- Refactor _CacheInfo and make it public as CacheInfo (potentially
breaking change).
- Return callable objects instead of functions from @cached and the
cachetools.func decorators (potentially breaking change).
- Do not set cache_info to None on @cached wrappers if info is not
set (potentially breaking change).
- Raise TypeError for @cachedmethod descriptors assigned after
class creation, i.e. without __set_name__ being called
(potentially breaking change).
- Various performance improvements.
- Various documentation improvements.
- Various test improvements.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
By default buildInfo embeds the compiler version string and CCFLAGS,
CXXFLAGS and LINKFLAGS, which carry --sysroot and -ffile-prefix-map
paths into mongod and mongos and trigger buildpaths QA warnings. Pass
a variables file that drops those entries from
MONGO_BUILDINFO_ENVIRONMENT_DATA.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The Node and Head swap() friends and the copy-and-swap assignment
operators in Biggie store.h are unused and refer to members that do
not exist. Backport the upstream removal.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
AI-Generated: Uses Claude Code
Upgrade to release 10.18.0:
- pikepdf.Pdf.add_pages_from now carries layers (optional
content) with the pages it copies. The optional content groups
that the copied pages depend on are listed in the destination's
/OCProperties, with the default visibility, place in the layer
list, lock, radio button groups and automatic states that the
source's default configuration gave them. Previously the groups
were copied but not listed, so viewers ignored them: the layer
list was empty and content hidden in the source was shown.
- pikepdf.Pdf.add_pages_from now carries bookmarks. Outline
items of the source that lead to a copied page are appended to
the destination's outline, keeping their hierarchy, titles and
style; items that lead to pages that were not copied are dropped.
- Both are on by default, which changes what existing callers of
add_pages_from get: the destination may gain an /OCProperties and
outline items it did not gain before. Pass layers='ignore' or
outlines='ignore' for the previous behaviour, for example if you
build the merged outline yourself. pikepdf.PageCopyResult
reports layers_added, outline_items_added and
outline_items_dropped.
- pikepdf.Pdf.check_pdf_syntax now performs the same checks
as qpdf --check and reports the same problems. It checks the
linearization data and hint tables of linearized files, which
previously required a separate call to
pikepdf.Pdf.check_linearization, and checks the interactive
form, embedded files, page labels and outlines. A document with
no pages is reported as ERROR: file does not contain any pages,
and a page whose content stream cannot be read is reported as
ERROR: page N: ... along with the other problems found, where it
previously raised pikepdf.PdfError.
- Inserting a pikepdf.Dictionary or pikepdf.Array
that refers to another Pdf into a Pdf now raises
pikepdf.ForeignObjectError, naming the key or index where the
foreign object was found, and leaves the target unchanged.
This covers an indirect object of another Pdf held anywhere in
the value, such as pdf3.Root.X = Dictionary(P=pdf1.Root.Y), and a
direct dictionary or array that another Pdf already contains.
Previously the value was accepted: the first kind made the Pdf
impossible to save, failing part way through writing, and the
second left two documents sharing one object. It applies to every
way of inserting a value, including
pikepdf.Pdf.make_indirect, pikepdf.Page.add_resource,
adding a page built from a dictionary, name and number trees, and
stream dictionaries. Use pikepdf.Pdf.copy_foreign to bring
the foreign object over first.
- A password containing a NUL character now raises {exc}ValueError,
both when opening a PDF and when encrypting one. Previously the
password was silently cut short at the NUL, so a wrong password
could open a file, and an encrypted file could be written with a
shorter password than requested. PDF passwords may not contain
NUL.
- Fixed threads interfering with each other inside one Pdf on
GIL-enabled builds, which could cause an object to be read as
None. The per-Pdf lock is now in force on every build, and
pikepdf.Pdf.lock works on GIL-enabled builds too.
- Methods implemented in Python that change a Pdf in several steps,
such as pikepdf.Page.add_overlay,
pikepdf.Pdf.add_pages_from and the pikepdf.sanitize functions,
now hold its lock until they finish. The thread safety section of
the architecture notes now says which calls are atomic.
- Two threads that each hold the lock of one Pdf and then need the
other's no longer deadlock; one of them gets a RuntimeError
instead. What a callback such as a pikepdf.TokenFilter may
do is now documented: see {ref}callback-restrictions.
- Fixed a crash, a native stack overflow that no Python except can
catch, when reading, saving or checking a PDF in which a JBIG2
image's /JBIG2Globals stream is itself JBIG2-encoded and leads
back to the image, directly or through other streams. Such an
image is now reported as unfilterable, as JBIG2-encoded globals
without a cycle already were: reading it raises
~pikepdf.exceptions.PdfError, extracting it raises
~pikepdf.exceptions.UnsupportedImageTypeError, and saving
writes it unchanged with a warning.
- A JBIG2 image's /JBIG2Globals are now read only when the image is
being JBIG2-decoded, rather than every time qpdf checks whether
the image can be decoded, which included every save.
- Reading the label of a page whose page label style is an unknown
name, such as /S /Z, now warns and keeps the label prefix, as an
invalid non-name style already did. Previously it raised
KeyError.
- Reading the label of a page whose number cannot be written in its
page label style, such as /S /R /St 0 or a Roman numeral above
5000, now warns and writes the number in decimal digits.
Previously it raised ValueError.
- Extracting an image whose /CalGray or /CalRGB colour space array
lacks its parameter dictionary now decodes it as the
corresponding device space, without an ICC profile, as a missing
/WhitePoint already did. Previously it raised IndexError.
- An ICCBased image whose profile stream omits the required /N, or
gives one that is not an integer, now takes its mode and default
/Decode from the profile's colour space. Previously its mode
raised KeyError.
- Fixed pikepdf.form.SignatureField.stamp_overlay stamping
the overlay twice when the signature widget names its page with
/P.
- Fixed a Pdf returned by pikepdf.Job.create_pdf not being
set up like other Pdf objects: setting its conversion_mode raised
pikepdf.PdfError, and on free-threaded Python none of its
methods were protected by a lock.
- Matrix.__array__(copy=False) now raises ValueError, as numpy
expects of an object that cannot share its memory. The check for
this was written in a way that never fired.
- A progress argument to pikepdf.Pdf.save that is not
callable is now rejected with TypeError before anything is
written. Previously the error was raised part of the way through
writing the file.
- Fixed a small memory leak each time
pikepdf.AcroForm.get_fields_with_qualified_name or
pikepdf.AcroForm.fix_copied_annotations returned a field.
- Iterating over a pikepdf.NameTree or
pikepdf.NumberTree now iterates over the keys it had when
the iteration began. Previously the tree was read as the
iteration went on, so changing it meanwhile gave undefined
results.
- Putting an object that belongs to another Pdf in a
pikepdf.NameTree or pikepdf.NumberTree now raises
pikepdf.ForeignObjectError at once, as it does for a
dictionary or an array. Previously the error was not raised until
the Pdf was saved.
- x in tree is now False for an x that cannot be a key of a
pikepdf.NameTree, such as an int, and for None in a
pikepdf.NumberTree. Previously these raised TypeError.
- Corrected the documentation and type hints of
pikepdf.NameTree, which said that names are bytes. Names
are, and have always been, str: qpdf reads each name as a PDF
text string and compares names by that text.
- Fixed building from source on Android (Termux), where importing
pikepdf failed with cannot locate symbol "_Py_TrueStruct" since
v10.6.0. The extension module is now linked against libpython
when the build interpreter is an Android Python, as that platform
requires. Android is not a tested platform.
Free-threaded Python fixes:
Many crashes and data races that occurred when several threads used the
same Pdf at once have been fixed. The test suite now runs under
ThreadSanitizer in continuous integration, which is how most of them
were found ().
- Every binding that reads or changes a Pdf now takes that Pdf's
lock, and the lock of any other Pdf among its arguments, enforced
at compile time. Many bindings previously did not, notably most
methods of pikepdf.NameTree, pikepdf.NumberTree,
attachments, annotations and pikepdf.AcroForm.
- Fixed crashes and data races in pikepdf.Page methods,
content stream parsing, adding pages from one Pdf to another, and
dropping the last reference to a Pdf while another thread used
one of its objects.
- A pikepdf.Dictionary or pikepdf.Array that belongs
to no Pdf is now protected by a lock shared by all such objects.
Threads that each build objects of their own contend for it, so
add a Dictionary or Array to its Pdf as soon as it is created
rather than building large structures before adding them.
- Fixed "dictionary changed size during iteration" when several
threads opened a Pdf's metadata for the first time at once.
- Threads that take turns using the same Pdf are no longer slowed
to a crawl when every CPU is busy.
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 0.17.4:
Preview features:
- [flake8-logging-format] Avoid behavior changes and syntax errors
in fixes (G004)
- [security] Implement tarfile-ignore-zeros-true
Bug fixes:
- Accept a bare raise before a semicolon
- Allow match identifiers after a semicolon
- Fix panic on BOM-prefixed files in diagnostic renderer
- [flake8-simplify] Report collapsible elif clauses after a
multi-statement if branch (SIM102)
Rule changes:
- Show more nonprinting characters in diagnostic fix diffs
Performance:
- Coalesce source slices when formatting attributes
- Collect return statements with a statement-only visitor
- [pyflakes] Defer value comparisons for repeated dictionary keys
(F601, F602)
- Format node fields directly when comment handling is unnecessary
- Reduce formatter source-slice overhead
- Reuse a callee's qualified name across lint rules
- Skip invalid string character checks when the source contains
none
- Use a Bloom filter for formatter comment lookups
- Use a concrete buffer for ordinary writes
CLI:
- Give NO_COLOR precedence in Ruff and ty diagnostics
- Honor CLICOLOR=0 in Ruff and ty diagnostics
Documentation:
- Correct the documented version and src defaults for ruff-action
- [flake8-bugbear] Make B014 example error out-of-the-box
- [flake8-no-pep420] Document preview behavior (INP001)
- [isort] Expand I001 documentation
Other changes:
- [syntax-errors] Extend __debug__ write check to attribute targets
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
0.5.19 moved the script tests into subdirectories, so ptest-list now
has entries like linking/non-default-device-node.lua. run-ptest
redirects each test's output to $arg2.out, and that directory does not
exist next to script-tester, so the redirection fails, script-tester
never runs and all 28 tests are reported as failed.
Flatten the path for the output file name.
The new node/suspend-* tests also require suspend-test-utils, which
upstream finds through WIREPLUMBER_DATA_DIR in the source tree. Install
it next to test-utils.lua.
All 64 tests pass on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_docstrings.py imports pytest_examples and
tests/test_tzinfo.py imports pydantic, neither of which the ptest
package depends on. pytest stops at the collection errors, so no test
ran at all:
E ModuleNotFoundError: No module named 'pytest_examples'
E ModuleNotFoundError: No module named 'pydantic'
Add both. test_docstrings.py then looks for core_schema.py and
README.md relative to the source tree, so install README.md and point
it at the installed core_schema.py.
Skip the ruff lint step of the docstring examples, as python3-pydantic
does. Outside the source tree ruff doesn't treat pydantic_core as first
party and flags the import order (I001) of 23 examples, plus a couple
of style rules newer than the examples. The examples are still run.
6025 tests pass and 126 are skipped on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_docs.py imports time_machine. The collection error stops
pytest before any test runs:
E ModuleNotFoundError: No module named 'time_machine'
With it, 6892 tests pass and 242 are skipped on qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
tests/test_pep517_backend.py imports the in-tree build backend from
packaging/pep517_backend, which pytest.ini puts on the path when run
from the source tree but which is not installed. Collection fails and
pytest stops without running any test:
E ModuleNotFoundError: No module named 'pep517_backend'
The test checks the CFLAGS/CPPFLAGS handling of the build backend,
which has no use on the target, so remove it.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
mongodb was re-enabled after having been skipped, and no longer builds
with the current toolchain and dependencies:
- setuptools 84 does not provide pkg_resources anymore; use
packaging.version to parse versions
- SCons 4.11 added an extra_libs parameter ahead of call in
CheckLibWithHeader(), so the positional call snippet was split into
bogus -l options and the OpenSSL check failed; pass call as a keyword
- clang 23 rejects out of range enum values in the bundled Boost 1.70
mpl::integral_c uses and a typo in Boost.Thread; backport the fixes
from newer Boost
- OpenSSL 4 makes ASN1_STRING opaque and removes ASN1_STRING_data() and
ERR_remove_state(); use the accessors available since OpenSSL 1.1
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The moduleconfig.py build script uses the 'imp' module which
is deprecated in favor of 'importlib' in python 3.12. This fixes
the build issue by replacing the affected portion of the code
and the package now builds fine on hosts with python 3.12.
Signed-off-by: Awais Belal <awais.belal@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Build the vala bindings when gobject-introspection data is enabled.
simple-scan uses colord when it is found and needs colord.vapi for it.
Tested by building colord and simple-scan for x86-64.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Build with meson, which 1.5.35 ships. The tools that generate the
compose table and the unicode dictionaries are built for the target and
run through the meson exe wrapper, so the bundled ax_prog_cc_for_build.m4
and its patch go away, and so does PKG_CONFIG_FOR_BUILD. The compose
table is read from libx11's locale data in the target sysroot, so
libx11-native is no longer needed.
Drop the two IBusAttrList backports, which are part of the release, and
rebase the dbus-launch patch onto the reworked make-dconf-override-db.sh.
Add a patch that defines pyoverridesdir without pygobject-3.0, which the
meson summary needs (Upstream-Status: Pending).
ibus-setup gets the path of the python3 used at build time, so point it
at ${bindir}/python3.
Tested by building ibus for x86-64.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
systemd-repart copies the rootfs into a temporary directory from
var_tmp_dir() to populate the filesystems. With $TMPDIR, $TEMP and $TMP
unset in the task, that is the host's /var/tmp, which the class adds to
PSEUDO_INCLUDE_PATHS for the faked ownership to apply there. pseudo
then tracks a host-wide directory shared by all builds and users, and
an interrupted run can leave its staging tree outside the build
directory.
Stage into ${WORKDIR}/repart-tmp instead, recreated on every run, and
cover only that with pseudo. The location is passed through $TMP rather
than $TMPDIR, because pseudo derives its own runtime paths from $TMPDIR.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
do_image_ddi depends on do_unpack of every recipe in DEPENDS. do_unpack
has no setscene task, so whenever do_image_ddi runs, do_fetch and
do_unpack are executed for all of them, even if everything else comes
from sstate.
The sources are not used: the DDI is built from IMAGE_ROOTFS, and
systemd-repart, erofs-utils and openssl come from the native sysroot,
which do_prepare_recipe_sysroot already populates through DEPENDS.
Suggested-by: Roman Nazarenko <roman.nazarenko@leica-geosystems.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 11.13.2:
- Fixed a secondary instance with open_files_async = true getting
stuck after TryCatchUpWithPrimary() returned PathNotFound for a
table file that the primary deleted before the background opener
reached it.
- Fixed blob direct write with more than one concurrent flush of a
column family: a later flush sealed and published the blob files
of the oldest pending memtable instead of its own, so flushes
failed with Corruption: VersionBuilder: Blob file #N already
added and the database stopped.
Change the the SRC_URI from https://github.com/facebook the new
Meta organization in GitHub: https://github.com/meta
Remove the following patches:
1. 0001-CMakeLists.txt-Make-the-test-discovery-occur-on-targ.patch
Because the change has been applied with commit 6d8370e:
https://github.com/meta/rocksdb/commit/6d8370ec56256c9f70daed364cdba9d1edabd417
2. 0001-checkpoint.h-Add-missing-includes-cstdint.patch
Because the change has been applied with commit 0a2ba2a:
https://github.com/meta/rocksdb/commit/0a2ba2a16441c1edd2a3d520e7d574e7ce78dbb2
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.19.1 declares protobuf < 6, while meta-python provides 7.36, and
google-cloud-pubsub 2.39.2, which Home Assistant 2026.11 uses, requires
google-api-core >= 2.25.0.
New runtime dependencies: proto-plus and opentelemetry-api. pytz is no
longer used. The package is built with setuptools.build_meta now. The
sdist on PyPI was renamed from google-api-core-2.19.1.tar.gz to
google_api_core-2.44.0.tar.gz; the underscore form is the pypi.bbclass
default, so PYPI_PACKAGE_SDIST, which pointed at the old name, is
dropped.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
1.63.2 declares protobuf < 6, while meta-python provides 7.36. The new
release accepts protobuf < 8. Needed by the google-api-core upgrade.
The package is built with setuptools.build_meta now. The sdist on PyPI
was renamed from googleapis-common-protos-1.63.2.tar.gz to
googleapis_common_protos-1.76.0.tar.gz; the underscore form is the
pypi.bbclass default, so PYPI_PACKAGE_SDIST, which pointed at the old
name, is dropped.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
python3-google-api-core 2.x requires proto-plus. A recipe for 1.27.1
exists in meta-python-ai, but meta-python cannot depend on that layer.
Only protobuf is a runtime dependency; google-api-core is needed by the
test suite only.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pydantic 2.14.1 in its test requirements and
package constraints. Upgraded together with python3-pydantic-core
2.50.1, which it pins.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pydantic 2.14.1 pins pydantic-core 2.50.1; with 2.46.5, "import pydantic"
raises SystemError because the versions do not match.
Refresh 0001-cargo.toml-Update-bitvec-to-use-radium-1.x.patch and
regenerate python3-pydantic-core-crates.inc with
bitbake -c update_crates.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins orjson 3.13.0.
Refresh the two x86 guard patches and regenerate
python3-orjson-crates.inc with bitbake -c update_crates.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pylint 4.1.3 in its test requirements.
Drop patches that are no longer needed:
- 0002-pyproject.toml-Keep-tool.setuptools.license-files.patch rewrote
the PEP 639 license and license-files keys into the older
tool.setuptools form. 4.1.3 requires setuptools >= 77, which handles
the PEP 639 keys, and OE-Core provides 84.0.0.
- 0003-astroid-4.1.2-endlineno.patch adjusted functional test
expectations for astroid 4.1.2 (for example MyClass instead of
MyClass.my_method). 4.1.3 ships the same expectations.
- 0004-checkers-variables-do-not-pass-asname-to-Import.infer.patch was
a backport of upstream commit 554b1d192434, which is part of 4.1.3.
Refresh 0001-Adjust-test-expectations-for-ptest.patch. The expected
output was regenerated by running the functional test with pylint 4.1.3
and astroid 4.3.4 installed into a virtualenv and the tests outside the
source tree, which is how the ptest sees pylint.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pytest-socket 0.8.1 in its test
requirements.
0.8.x builds with uv_build instead of poetry-core. Backport the upstream
change that allows uv_build < 0.14, since OE-Core provides 0.13.7.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins lru-dict 1.4.1.
The sdist is now published as lru_dict-*.tar.gz, the default name, so
drop PYPI_PACKAGE_SDIST. 1.4.x pins the build to setuptools==80.9.0 and
no longer needs wheel; relax the setuptools pin with a patch and drop
the python3-wheel-native dependency.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins SQLAlchemy 2.0.54 (core and the recorder
integration).
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Home Assistant 2026.11 pins pychromecast 14.1.1 for its cast integration.
Drop 0001-pyproject.toml-relax-build-requirements.patch. It removed the
upper bounds setuptools < 83 and wheel < 0.47 from the build
requirements. 14.1.1 allows setuptools < 85 and wheel < 0.49, and
OE-Core provides setuptools 84.0.0 and wheel 0.48.0, which are within
the new bounds.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Needed together with the Cython 3.3.1 upgrade in OE-Core: 0.4.1, with the
backported "Update Cython to version 3.2.3" patch, requires
Cython ~= 3.2.0 and does not build with Cython 3.3. Home Assistant
2026.11 also pins propcache 0.5.4.
Drop both local patches:
- 0001-Update-Cython-to-version-3.2.3-184.patch backported the change
from Cython ~= 3.1.0 to Cython ~= 3.2.0. 0.5.4 requires
Cython >= 3.2.0 (packaging/pep517_backend/_backend.py), so the
backport is not needed; it would even pin the build back to
Cython ~= 3.2.0.
- 0001-build-wheel-in-place.patch hardcoded build_inplace=True in the
in-tree build backend. 0.5.4 adds the build-inplace config setting
for this, so the recipe passes "-C build-inplace=true" in
PEP517_BUILD_OPTS instead.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 requires httpcore2, anyio and truststore, so "import httpx2"
fails with "No module named 'httpcore2'". Home Assistant 2026.11 imports
httpx2 at startup and does not start without them.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 imports httpcore2, which is released as a separate package from
the same repository and with the same version.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
httpx2 and httpcore2 require truststore. Home Assistant 2026.11 pins
truststore 0.10.4.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
numba is optional for haversine, but haversine only catches
ModuleNotFoundError. With the NumPy 2.5 from OE-Core, numba 0.66 (as in
meta-python-ai) raises
ImportError: Numba needs NumPy 2.4 or less. Got NumPy 2.5.
which makes "import haversine" fail. Catch ImportError instead.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
pint requires flexcache, flexparser and typing-extensions, but only the
ptest package pulled in flexcache and flexparser, so "import pint" fails
with "No module named 'flexcache'" on an image without the ptest.
pint is extended to native and nativesdk, so flexcache and flexparser
are as well.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
The upgrade to 1.4.4 only changed SRC_URI[sha256sum], which is unused
since the recipe fetches from git, so SRCREV still pointed at a 1.4.2
era commit and the package installed pika 1.4.2 under version 1.4.4.
Point SRCREV at the 1.4.4 tag commit and drop the unused checksum. Add
tag=${PV} to SRC_URI so that the fetcher checks that SRCREV is the
commit of the release tag.
AI-Generated: Claude Code, Claude Opus 5.5
Signed-off-by: Thomas Roos <thomas@roosesweb.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
- mod_authnz_ldap: Fix crashes in 2.4.69 reported on Windows
- mod_cgid: Increase limits for number and length of environment variables,
URI and arguments
- mod_substitute: Fix an integer overflow that can happen in very special
setups
- mod_cache: Do not store a response whose "Vary: *" was set via
"Header always"
- mod_dav_lock: Fix a heap buffer overflow in dav_size_indirect(), which
under-reserved space for the stored key length field, written as
apr_size_t but sized as int
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2.7 is the new release series; library ABI is unchanged (libldap.so.2,
liblber.so.2). It also builds the symbol version map through the
preprocessor (ITS#9739), which drops most entries for code that is not
configured in.
- back-perl and back-sql were removed upstream, drop their
PACKAGECONFIGs.
- Refresh remove-user-host-pwd-from-version.patch for the
LDAP_GCCATTR((unused)) attribute added in build/mkversion.
- Add a patch to guard the remaining SASL-only symbols in ldap.map.in;
without Cyrus SASL lld fails:
ld.lld: error: version script assignment of 'OPENLDAP_2.200' to
symbol 'ldap_int_sasl_config' failed: symbol not defined
This replaces the -Wl,--undefined-version workaround meta-clang
carried for openldap.
License checksums are unchanged. Tested on qemux86-64 with clang/lld:
openldap and samba (with ldap) build.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
wafsamba generates version scripts that name symbols which may not
exist in the library: _end, __bss_start and _edata are always listed as
local, and the per-version nodes carry symbols from older ABI signature
files that were later removed (e.g. tdb_do_delete). GNU ld ignores
these, but lld rejects them by default:
ld.lld: error: version script assignment of 'local' to symbol '_end'
failed: symbol not defined
meta-clang used to add -Wl,--undefined-version for libtalloc, libtdb,
libtevent, libldb and samba. Since the scripts are generated by design
this way, do it once in the class for all its users; binutils accepts
the option too. FreeBSD ports do the same for talloc and tdb.
Tested: libtalloc, libtdb, libtevent, libldb ptest images pass on
qemux86-64 with clang/lld; samba builds.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Changelog
---------
Changes for version 20261020
Update from Mozilla repository to 2026-10-20
Denylisted certificates:
emSign ECC Root CA - G3
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Add -M30% -C --find-copies-harder to the git send-email example in
README.md so that git format-patch detects renames and copies more
aggressively.
Patches that move or copy files then show only the changed lines
instead of full file deletions and additions, which makes them
smaller and easier to review.
Suggested-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.4:
Breaking changes:
- CMake:
- The minimum CMake version is now 3.15, up from 3.12.
- Library file names changed on MSVC: z is now libz, as in
libz.dll, libz.lib, and the static libzs.lib. minizip's
libraries changed the same way.
- On Cygwin, the libraries now use the lib prefix.
- Contrib targets and tests built as part of zlib are now
prefixed with zlib_. Several test targets were renamed to one
scheme, for example zlib_examplestatic and minigzipstatic.
- The zlib1.dll option ENABLE_BZIP2 is now
ZLIB1_DLL_ENABLE_BZIP2.
- When not otherwise determined, z_off_t is again long, as in
1.3.1, instead of 1.3.2's long long. Windows applications built
with 1.3.2 headers should be recompiled; see Enhancements for
64-bit offsets.
- deflateReset() now resets the gzip header set by
deflateSetHeader(), as zlib.h has always said. Code relying on
the header persisting must set it again.
- Raw deflate that completes exactly at the end of the output
buffer now returns Z_STREAM_END instead of Z_OK, as documented.
- gzopen() with "x" now fails where O_EXCL isn't available, instead
of truncating an existing file (Trail of Bits TOB-ZLIB-009).
- gzip reading now delivers the data decompressed before a read
error, and only then reports the error.
Security fixes:
- Non-blocking gzwrite() had a buffer overflow; CVE-2026-85091
(reported by mat-mo; also TOB-ZLIB-003).
- inflateGetDictionary() could write up to 8 MB past the caller's
32K buffer (Theorem THM-ZLIB-001). This took a zlib header with
an invalid window size, then inflateReset() or inflateSync().
Affects 1.3.1 and 1.3.2.
- inflateSync() before the window size was known allocated a
one-byte window that could later be overrun (TOB-ZLIB-004).
- inflatePrime() could lead inflate() to read before the start of
the input (TOB-ZLIB-014).
- Repeated deflatePrime() calls could write past the pending buffer
(TOB-ZLIB-013).
- inflateBack() failed to detect distances too far back, and copied
uninitialized memory to the output (reported by Kornel Lesiński).
- gzseek() forward before any data was written could write
uninitialized memory to the gzip output (found by Claude Opus
5.5).
- deflateResetKeep() used mid-stream could read outside the window
(reported by Jason Gross).
- gzdopen() now sets close-on-exec with the correct flag
(TOB-ZLIB-008).
- minizip:
- A double free in block_central_name() (reported by Oculytic),
and a NULL dereference on repeated zipAlreadyThere() calls
after a bad central directory (reported by Naveed Khan).
- Validation of extra-field sizes, plus portable, alignment-safe
reading, in zipRemoveExtraInfoBlock() (reported by Naveed Khan
and jmestwa-coder).
- unzip no longer reads Zip64 values from outside their
extra-field record (reported by Mohamed Elnady). It also uses
only the Zip64 locator immediately before the end of central
directory record (reported by snajafov). Crafted archives could
make minizip report different entries than other readers.
- miniunz could create directories outside the extraction
directory (reported by Naveed Khan), and on Windows write files
anywhere (reported by Trail of Bits). Fixed by Naveed Khan.
Path names are now processed by component.
- contrib/infback9: removed out-of-bounds pointer arithmetic in
inftree9.c; CVE-2026-4738 (fix by npt-1707, submitted by
CrossVR). The pointers return in bounds before use and no known
compiler mishandles this, so the critical rating overstates it,
though it could trap on capability hardware such as CHERI.
Bug fixes:
- gzip reading:
- Restored the detection of truncated gzip streams, part of which
was lost in 1.3.2. Also fixed a complete stream being reported
as truncated.
- An error in the first member is no longer treated as trailing
garbage.
- Corrected pending-skip handling in gz_skip(), gzdirect() and
forced seeks at EOF.
- gzgets() now returns an empty string when promised.
- gzip writing:
- Successive SEEK_CUR seeks no longer lose zero fill.
- Zero fill is now handled correctly after a write error.
- gzprintf() is now all-or-nothing when blocked, and is no longer
a stub when compiled as C++.
- gzseek() leaves the position unchanged on failure.
- gzopen_w() now works with paths not representable in the
locale.
- inflate:
- total_in was short six bytes on Z_NEED_DICT.
- inflateReset() now restores the requested window size, and the
wrap after inflateSync().
- inflateSetDictionary() rejects a null dictionary.
- With PKZIP_BUG_WORKAROUND, the code tables were slightly too
small.
- deflate:
- A bad deflateSetDictionary() call is now detected as promised.
- A failed deflateCopy() or inflateCopy() leaves the destination
safe to end.
- Removed a possible overflow in deflate_stored() comparisons.
- Undefined behavior removed in gzwrite.c, gzseek, gz_vacate() and
mztools.c.
- minizip:
- zip.c no longer writes corrupt headers when a Zip64 field
overflows an extra field (reported by mzfr and itsgaldoron), or
for Zip64 entries with file comments.
- zipOpen3() no longer leaks memory or returns a freed comment
pointer on failure.
- Added allocation checks.
- Build:
- configure now builds the shared library with linkers such as
lld that reject undefined symbols in zlib.map, including for
--solo.
- zlib.h no longer depends on NULL being defined.
- zip.c builds with NO_ADDFILEINEXISTINGZIP.
- The test programs use the generated zconf.h when building out
of tree.
- Many CMake fixes: pkg-config files, installation of headers and
of minizip's configuration, symbol prefixing, assembler
detection, and parallel testing. It also works with CMake 4.
Enhancements:
- 64-bit offsets on Windows with MSVC or MinGW, by compiling the
application with _FILE_OFFSET_BITS=64 or _LARGEFILE64_SOURCE. The
library itself needs no changes.
- Platforms:
- Android large file support.
- An export list on AIX.
- -Wno-psabi, only where the PowerPC note would appear.
- s390x VGFMAFLAG in configure.
- Win32 Makefile.msc builds for ARM64.
- minigzip's mmap code uses POSIX types.
- CMake:
- Package components, with _FOUND variables.
- Installation and export of zlib1.dll and zlibwapi.dll.
- Contribs build standalone, with zlib's defaults.
- Tests consolidated, and tests on Windows.
- minizip:
- The traditional encryption header uses a PCG generator instead
of rand().
- Fewer compiler warnings.
- Documentation:
- Clarified that undocumented functions are not part of the API.
- inflateGetHeader() header reuse.
- deflateBound() and deflateSetDictionary() ordering.
- The application's responsibilities in unzip.h.
Known issues:
- contrib/iostream2 is unsafe on untrusted input (reported by Trail
of Bits). When reading a string, it uses the length stored in the
compressed data without checking it, so a crafted file can write
past the end of the destination buffer. Use contrib/iostream3
instead.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Upgrade to release 1.1.0:
Changes:
- Add tss_request_add_bora_tags() and tss_request_add_durant_tags()
to the API
- Update auth client version and add Ap,Timestamp to requests
- Restrict Yonkers tag selection to SysTopPatch
Fixes:
- Handle realloc() failure in tss_write_callback()
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Leon Anavi
Khem Raj
Gyorgy Sarvari
Awais Belal
Markus Volk
Johannes Schneider
Thomas Roos
Ankur Tyagi
Jason Schonberg